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A theorem by Shannon and the Holevo theorem impose 
that the efficiency of any protocol for quantum key distribu- 
tion, £, defined as the number of secret (i.e., allowing eaves- 
dropping detection) bits per transmitted bit plus qubit, is 
£ < 1. The problem addressed here is whether the limit £ = 1 
can be achieved. It is showed that it can be done by split- 
ting the secret bits between several qubits and forcing Eve 
to have only a sequential access to the qubits, as proposed 
by Goldenberg and Vaidman. A protocol with £ = 1 based 
on polarized photons and in which Bob's state discrimination 
can be implemented with linear optical elements is presented. 

PACS numbers: 03.67.Dd, 03.67.Hk, 03.65. Bz 



the system in one of various quantum states pi with a 
priori probabilities pi, so the input signal is represented 
by the density matrix p = ^PiPi- The intended receiver 
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(Bob hereafter) makes a measurement on the quantum 
system, and from its result he tries to infer which state 
Alice prepared. A theorem stated by Gordon Q and 
Levitin ||, and first proved by Holevo asserts that 
if Bob is restricted to making separate measurements on 
the received states, then the average information gain is 
bounded by 



I(A:B)<S(p)-^2 Pi S( Pi 
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In information theory one of the most fundamental 
questions is how efficiently can one transmit information 
by means of a given set of resources. If this informa- 
tion is classical (i.e., it can be expressed as a sequence of 
zeros and ones, or "bits" ) a crucial theorem of classical 
information theory states that if a (classical) communi- 
cation channel has mutual information I(X: Y) between 
the input signal X and the received output Y, then that 
channel can be used to send up to, but no more than, 
I(X: Y) bits Q. The mutual information is defined as 

I(X:Y)=H(X)-H(X\Y), (1) 

where H is the Shannon entropy, which is a function of 
the probabilities p(xi) of the possible values of X, and 
is given by H(X) = — J2p( x i) \°E,2P( x i)i where the sum 

i 

is over those i with p{xi) > 0. H(X\Y) is the expected 
entropy of X once one knows the value of Y, and is given 
by 



H(X\Y) 
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p(yj) 



p(x i \y j )log 2 p(x i \y j ) 



(2) 



A simple application of the above theorem reveals that 
using a classical two-level system as a communication 
channel (i.e., if the input signal X can take only two 
values xq and x\) one is allowed to send up to, but no 
more than one bit [and this occurs if p(xq) — p{x\) — 
0.5]. 

On the other hand, suppose one wishes to convey clas- 
sical information using a quantum system as a commu- 
nication channel. The sender (Alice hereafter) prepares 
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where S is the von Neumann entropy, given by S (p) = 
— Tr(plog 2 p). The equality in (|3|) holds if, and only if, 
all the transmitted states pi commute. Thus the amount 
of information accessible to Bob is limited by the von 
Neumann entropy of the ensemble of transmitted states. 
The maximum von Neumann entropy of an ensemble of 
quantum states in a Hilbert space of n dimensions is n, 
and can be reached only if the "alphabet" defined by p 
is a mixture with identical probabilities of n mutually 
orthogonal pure quantum states (called "letter" states). 
Therefore, as a simple application of the Holevo theo- 
rem reveals, the maximum classical information accessi- 
ble to Bob when Alice sends a two-level quantum system 
("qubit") is one bit. This is what we will refer to as the 
Holevo limit. Achieving the Holevo limit requires noise- 
less quantum channels and perfect detectors, therefore 
we will assume so hereafter. 

Either a classical or quantum n-level system can con- 
vey log 2 n bits at the most. In this sense, quantum 
communication is as efficient as classical communication. 
However, there is a task that cannot be achieved by clas- 
sical means: secure key distribution. Now suppose Alice 
wishes to convey a sequence of random classical bits to 
Bob while preventing that any third unauthorized party 
(Eve hereafter) acquires information without being de- 
tected. This problem, known as the key distribution 
problem, was first solved by Bennett and Brassard j^] 
using quantum mechanics. In recent years many differ- 
ent protocols for quantum key distribution (QKD) have 
been proposed ]q-|r^]. Most of them share the follow- 
ing features: (i) They need two communication channels 
between Alice and Bob: a classical channel which is as- 
sumed to be public but which cannot be altered. Its tasks 
are to allow Alice and Bob to share a code and informa- 
tion to prevent some kinds of eavesdropping, to trans- 
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mit the classical information required for each step of 
the protocol, and to check for possible eavesdropping. A 
quantum channel (usually an optical fiber or free-space), 
which must be a transmission medium that preserves the 
quantum signals (usually the phase or the polarization of 
photons) by isolating them from undesirable interactions 
with the environment. It is an "insecure" channel in the 
sense that Eve can manipulate the quantum signals, (ii) 
A sequence of m steps. A step is defined as the minimum 
part of the protocol after which one can compute the ex- 
pected number of secret bits received by Bob, b s . Each 
step consists on an interchange of a number q t of qubits 
(using the quantum channel) and a number b t of bits (us- 
ing the classical channel) between Alice and Bob. (iii) A 
test for detecting eavesdropping. Alice and Bob can de- 
tect Eve's intervention by publicly comparing (using the 
classical channel) a sufficiently large random subset of 
their sequences of bits, which they subsequently discard. 
If they find that the tested subset is identical, they can 
infer that the remaining untested subset is also identical 
and secret. Only when eavesdropping is not found, the 
transmission is assumed to be secure. 

From the point of view of information theory, a natural 
definition of efficiency of a QKD protocol, £ is |13]] 



£ = 
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where b s , qt and b t were described above. This defini- 
tion omits the classical information required for estab- 
lishing the code or preventing and detecting eavesdrop- 
ping, because it is assumed to be a constant, negligible 
when compared with the number of transmitted secret 
bits, mb s . The combination of classical information the- 
ory plus the Holevo theorem imposes an upper limit to 
the efficiency of any transmission of classical information 
(secret or not) between Alice and Bob. In particular, 
they imply that the efficiency of any QKD protocol is 
£ < 1. The problem addressed in this paper is whether 
the limit £ — 1 can be achieved. Or, more generally, 
how efficiently random classical information can be dis- 
tributed between Alice and Bob (who initially share no 
information), while preventing that Eve acquires infor- 
mation without being detected. As a close inspection of 
some of the most representative QKD protocols reveals, 
so far none of them reaches the limit £ = 1 (see Table 
I) Q. A QKD protocol with £ = 1 requires that Bob 
can identify with certainty n different states, where n 
is the dimensionality of the Hilbert space of the quan- 
tum channel, TL n . Bob can only distinguish n states with 
certainty if all of them are mutually orthogonal. Since 
there are no n mutually orthogonal mixed states in H. n , 
then the letter states will be necessarily an orthogonal 
basis of pure states. If the quantum channel is a single 
quantum n-level system, the requirements b t = and 
b s = It — log 2 n are impossible to achieve, because then 
Eve could use the cloning process pRffq], to find out 



what was the state sent by Alice without being detected. 
This problem can be avoided if the quantum channel is a 
composed quantum system. Then, as was first discovered 
by Goldenberg and Vaidman 0], the secret information 
can be split between the subsystems, so that if Eve has 
no access to all the parts at the same time, she cannot 
recover the information without being detected. Golden- 
berg and Vaidman's protocol was extended and improved 
by Koashi and Imoto |icj . 

In this Letter we will present a protocol £ = 1 based 
on [ppC]] and on the idea of using a larger alphabet that 
saturates the capacity of the quantum channel. Suppose 
that the quantum channel is composed by two qubits (1 
and 2) prepared with equal probabilities in one of four 
orthogonal pure states {|V>i)}j and that Eve cannot ac- 
cess qubit 2 while she still holds qubit 1. To obtain this 
"sequential" access for Eve, we can use the configuration 
in Fig. 1 HQ: there are two paths between Alice and 
Bob, one for qubit 1 and the other for qubit 2, and both 
have the same length L. Alice sends out the two qubits 
at the same time. Qubit 1 flies to Bob while qubit 2 is 
still in a storage ring (protected against Eve's interven- 
tion) of length I > L/2. The aim of this storage ring is to 
delay qubit 2 until qubit I has reached the protected part 
of the channel near Bob. In that protected part there is 
another storage ring of length I, so both qubits arrive at 
the same time to Bob's analyzer. To guarantee that Eve 
has a true sequential access to the two qubits, Alice and 
Bob (using the classical channel) must know when qubit 
1 of the first pair will arrive to Bob and which will be the 
delay between pairs fljo| . 

Any QKD protocol must fulfill the fact that Eve can- 
not learn the bits without disturbing the system in a 
detectable way. In addition, for practical purposes, it 
would be interesting if Bob could easily read the letter 
states. In our protocol, the choice of letter states will be 
strongly limited by these requirements. Let us denote as 
pnm those orthogonal basis of letter states composed of 
p product states, n nonmaximally entangled states, and 
m maximally entangled states. It can be easily seen that 
the letter states cannot be a 400 basis, because then Eve 
can learn at least one bit without being detected. For 
instance, if the basis was {|00) , 1 10) , | + 1) , |— 1)}, then 
Eve can learn one bit just by performing a local measure- 
ment on the second qubit and allowing the first one to 
pass by. In addition, the letter states cannot be a 004 
basis, because then Eve can learn the two bits without 
being detected just by preparing a pair of ancillary qubits 
(3 and 4) in a maximally entangled state, replacing qubit 
1 with qubit 3, reading the state of the combined system 
1, 2 after receiving qubit 2, and finally changing the max- 
imally entangled state of the combined system 3,4 by a 
simple unitary transformation on particle 4. Other possi- 
ble strategies for eavesdropping in the context of sequen- 
tial access, like broadcasting jlT]], have been investigated 
by Mor pa]. Mor's requirement to avoid eavesdropping 
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(reduced density matrices of the first subsystem must 
be nonorthogonal and nonidentical, and reduced density 
matrices of the second subsystem must be nonorthogonal 
PH ) applies to the case when two (pure or mixed) letter 
states are used. As can be easily checked, Mor's condition 
is satisfied by at least two pairs of states if one uses an or- 
thogonal basis of four pure states different than 400 and 
004. This means that Eve must use at least two different 
strategies to obtain information of the key. If for a par- 
ticular state she uses the wrong strategy, Alice and Bob 
will have a high probability to detect Eve. Therefore, we 
conclude that an orthogonal basis of a type different than 
400 or 004 can be used as letter states in a QKD protocol 
with sequential access. However, these bases present dif- 
ferent advantages and disadvantages. On one side, it will 
be interesting to use the higher dimension of the quan- 
tum channel to improve the probability of detecting Eve 
from those protocols using lower dimensional quantum 
channels or smaller alphabets. For instance, in a proto- 
col based on two-letters with the same probability like 
H , for each bit tested by Alice and Bob, the probability 
of that test revealing Eve (given that she is present) is \. 
Thus, if ./V bits are tested, the probability of detecting 
Eve is 1 — (|) . However, in a protocol using two qubits 
as a quantum channel, if Alice and Bob compare a pair of 
bits generated in the same step, the probability for that 
test to reveal Eve can be | . Thus if n pairs [N = 2n bits) 

are tested, the probability of Eve's detection is 1 — {^) N ■ 
However, this improvement is possible only if Eve can- 
not use the same strategy to (try to) read two of the four 
states. This scenario can be achieved with bases such as 
121, 130, or 040. However, using these bases have a big- 
ger (from an experimental point of view) disadvantage: 
as the analysis of some particular cases suggests, if the 
qubits are polarized photons, then Bob cannot discrim- 
inate with 100% success basis like 121, 130, or 040, us- 
ing an analyzer with only linear elements (such as beam 
splitters, phase shifters, etc.) [HJ. A general proof of this 
statement for any kind of basis is still an open problem. 
Such proof exists for the 004 bases |20| , pT|] . However, 
bases such as 202 or 220, although they do not improve 
the probability of Eve detection, can be used for QKD in 
the Holevo limit, and allow Bob to completely discrimi- 
nate between the four states without requiring conditional 
logical gates, like CNOT gates between the two qubits, 
or even electronics to control conditional measurements 
on the second qubit depending on the result of the mea- 
surement on the first qubit. I will present an example 
of a QKD protocol in the Holevo limit of this last case. 
Consider the following 202 basis: 



where \H) i means photon i linearly polarized along 
a horizontal axis, and \V) i means photon i linearly 
polarized along a vertical axis, and symmetrization 
is not written explicitly [for instance, \HV) means 
^5 (l-ff)i |V>2 + V) 1 \H) 2 )]. Alice prepares one of the 
four states (|5|)-(|) and sends them out to Bob using a 
setup to guarantee Eve's sequential access (Fig. 1). The 
two qubits arrive at Bob's state analyzer at the same 
time. In the case of the four photon polarization states 
Bob analyzer to discriminate with 100% (theo- 
retical) success between the four states can be realized 
in a laboratory using a 50/50 beam splitter, followed by 
two polarization beam splitters (which transmit horizon- 
tal polarized photons and reflect vertical polarized pho- 
tons), and four detectors ^,|H; see Fig. 2. After the 
polarization beam splitters, as a simple calculation (up 
to irrelevant phases) reveals, the four states @-(||) have 
evolved into 





= WH) , 




(5) 




= * (\HV) 


+ 1^0), 


(6) 




= * (\HV) 


-1^0), 


(7) 




= \VV) , 




(8) 



h/>o> - ^ (iMi) - I-D3-D3)) , (9) 

h/>i> - £ (IB1D2) - I-D3-D4)) , (10) 

IV2} - ^ (\D 2 D 3 ) - , (11) 

|V> 3 ) - ^ (\D 2 D 2 ) ~ lAA)) , (12) 

where \DiDj) means one photon in detector Di and 
the other in detector Dj, again symmetrization is 
not written explicitly [for instance, \D1D2) means 
^ (\D 1 ) 1 \D 2 ) 2 + \D 2 ) 1 |Di) 2 )]. Thus, a single click on 
detectors D\ or D3 (D 2 or D4) signifies detection of \ipo) 
(l^)), while two clicks, one on D\ and the other on D 2 , 
or one on D3 and the other on D4 (one on D 2 and the 
other on D3, or one on D\ and the other on D4) signifies 
detection of (\^p 2 ))- 

Long storage rings have a low efficiency for the trans- 
mission of polarized photons, so other methods to achieve 
sequential access must be developed in order to perform 
QKD in the Holevo limit for long distances. For instance, 
Weinfurter has suggested Jgij] using momentum-time en- 
tangled photons and a Franson-type device 25 1. On the 
other hand, QKD protocols with £ = 1 can be extended 
to quantum channels composed of n > 2 subsystems with 
to > 2 levels, supposing Eve has only a sequential access 
to the subsystems. If nm > 6 Alice could use even a basis 
with only product states |2q| , although then Bob would 
need some quantum interaction between the subsystems 
in order to achieve a complete discrimination of the letter 
states |27]]. 
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Polavieja, H.-K. Lo, and H. Weinfurter for very useful 
comments and suggestions. Part of this work has been 
done at Cambridge University and at the Sixth Benasque 
Center for Physics under support of the University of 
Seville (Grant No. OGICYT-191-97) and the Junta de 
Andaluci'a. (Grant No. FQM-239). 
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Scheme 

Bennett, 1992 < 0.5 

Bennett and Brassard, 1984 || 0.5 
Goldenberg and Vaidman, 1995 

Ekert, 1991 §,§ 1 

Koashi and Imoto, 1997 |Io) 1 

Cabello, 2000 O] 2 



1 
1 

> 1 
1 

1 



< 0.25 
0.25 

< 0.33 
0.5 
0.5 
0.67 



TABLE I. Efficiency £ of different QKD protocols. In Gold- 
enberg and Vaidman's protocol, b t contains the sending time 
of the qubits. In Ekert's protocol the values refer to a more ef- 
ficient version, suggested by Ekert to the authors of Ref. 
in which Alice tells Bob her choice before Bob's measure- 
ment. Both in Goldenberg and Vaidman's, and in Koashi 
and Imoto's protocols, q t is taken to be 2 because their quan- 
tum channel is a photonic state in two paths, which is a four- 
dimensional Hilbert space, although their letter states do not 
span the whole Hilbert space. 
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FIG. 1: Scheme to force that Eve has only a sequential access 
to the two qubits. 
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FIG. 2: Scheme of Bob's analyzer to discriminate unambigu- 
ously between the four states (|^)-(^|). 
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